GPO assigned to OU only works for certain users

[bmonrad]

Hi,

I am trying to work my way through The Book, but we are stuck on a pretty basic thing:

We have some custom GPOs at the domain level that apply correctly for all users (WSUS settings, Hide Network Neighborhood in Win2K, Windows Firewall settings), but we are having trouble with OU-specific custom login scripts and even built-in "test" settings (such as removing the Recycle Bin from the Desktop).

These OU-specific objects only seem to apply correctly for users in the OU that are assigned to a security group that has local admin rights. The best info we can get out of the GP Modeling Wizard for the non-admin users is that the objects are "inaccessible"...

Local admin rights as a signifier may be a red herring, as there are probably other differences between the security groups besides the fact that the user security group that "works" has local admin rights and the user security groups within the OU that don't "work" (but need to) are Power Users.

If anyone has pointers on where to start looking at permissions (local machine settings or GP settings?), or how to get any more info than "inaccessible" from the GP Modeling Wizard, we would be grateful.

Thanks!

ben monrad
technology
kyrene school district

[bmonrad]

OK, I have more information - the issue is only affecting XP(SP2)clients...

GP on Win2K clients works OK for all users, and on the XP clients we are getting USERENV error type 1030 and 1101.

Our DCs are Server2003, and the rights for Authenticated Users are set to Read/Apply Group Policy.

Apparently it is a known issue, but we haven't googled a solution yet...

Thanks again in advance.